EUVD-2026-50604
GHSA-f6mj-jpwj-95hj
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessCompromise renderer process (prior foothold)
-
DeliveryServe crafted HTML page
-
ExploitTrigger DevTools race condition
-
ExecutionWin timing window
-
PersistEscape renderer sandbox
-
ImpactGain browser-process privileges on macOS
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V15 - Secure Coding and Architecture Concurrency control, locking
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires that the attacker has ALREADY compromised the renderer process - this is the explicit prerequisite stated in the CVE description, making the bug a sandbox-escape second stage rather than a standalone entry point. It further requires the victim to load a crafted HTML page (UI:R / user interaction) and the attacker to win a DevTools race condition, a non-deterministic timing window that limits reliability. It is platform-limited to the macOS build of Chrome and to versions prior to 151.0.7922.72. The limiting factors - prior renderer foothold, timing-race non-determinism, and Mac-only scope - meaningfully reduce realistic risk below what the 9.6 CVSS alone implies. |
| Impact | The signals conflict and must be weighed carefully. The NVD CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C, all-High impact) yields 9.6, but this overstates real-world ease: the description explicitly requires an attacker to have ALREADY compromised the renderer process, which is not reflected by PR:N - verify this discrepancy, as the attack is realistically a chained second stage rather than a standalone remote exploit. Chromium's own team rated the severity only Medium, and EPSS is 0.14% (4th percentile), both pointing to limited practical exploitation likelihood. It is not listed in CISA KEV and no POC is known. Winning a race condition (a timing-dependent operation) further raises real attack complexity above the vector's AC:L. Net assessment: patch on a normal Chrome cadence, but this is not an emergency drop-everything issue absent evidence of a paired renderer exploit; it is a high-CVSS number driven by scope change rather than a high-real-risk standalone vulnerability. |
| Exploit ScenarioDerived | An attacker first lands a separate renderer-level exploit (e.g., via a malicious or compromised website the victim visits), gaining code execution inside Chrome's sandboxed renderer. From that foothold, they serve a crafted HTML page that triggers the DevTools race condition, winning the timing window to escape the sandbox and gain the more-privileged browser-process context on the victim's Mac. No public POC is currently known, and the race-condition timing plus required prior renderer compromise make reliable exploitation non-trivial. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Jul 31, 2026
Sandbox escape in Google Chrome for macOS (versions before 151.0.7922.72) can be achieved by an attacker who has already compromised the renderer process, chaining a DevTools race condition via a crafted HTML page to break out of the renderer sandbox. Reported internally by the Chrome team and rated Medium by Chromium, it carries an NVD CVSS of 9.6 due to the scope change, though EPSS is very low (0.14%, 4th percentile). No public exploit identified at time of analysis and it is not on CISA KEV, indicating no confirmed active exploitation.
RemediationAI
Vendor-released patch: 151.0.7922.72 - upgrade Google Chrome on macOS to 151.0.7922.72 or later and restart the browser to ensure the update is applied (verify via chrome://settings/help). This is delivered through the Chrome Stable channel auto-update; enterprises using managed/pinned deployments should push the updated build promptly. Reference the vendor advisory at https://chromereleases.googleblog.com/2026/07/stable-channel-update-for-desktop_0887107924.html. As an interim compensating control until updated, reduce the attack surface that enables a renderer compromise (the required precondition): enable Enhanced Safe Browsing, deploy the site-isolation and strict-URL policies via enterprise policy, and restrict or disable developer-tools access with the DeveloperToolsAvailability policy - noting the trade-off that disabling DevTools impacts developers and web-app debugging workflows. These controls narrow the chain but are not substitutes for the patch.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The flaw is a CWE-362 race condition (concurrent execution using a shared resource with improper synchronization) inside Chrome's DevTools subsystem, which mediates privileged instrumentation and debugging interactions between the sandboxed renderer and the more-privileged browser process. Because DevTools bridges trust boundaries, a timing window where shared state is accessed without proper locking can be abused to violate the renderer sandbox that normally confines untrusted web content. The affected component is the Chromium/Blink browser engine as shipped in Google Chrome on macOS (CPE cpe:2.3:a:google:chrome), and the bug is platform-specific to the Mac build per the advisory. Sandbox escapes of this class are typically used as the second stage of an exploit chain, following an initial renderer-level memory-corruption or logic bug.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
Sources disagree (Medium–Critical)AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H
Requires a prior renderer compromise (PR:L) and winning a non-deterministic race (AC:H); a crafted page adds UI:R, and sandbox escape crosses a trust boundary (S:C) with full impact.
vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.
CVSS VectorVendor: Chrome
Lifecycle Timeline
4DescriptionCVE.org
Race in DevTools in Google Chrome on Mac prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML page. (Chromium security severity: Medium)
Executive ViewAI
Google Chrome on macOS (versions before 151.0.7922.72) contains a critical vulnerability (CVE-2026-17855, CVSS 9.6) that allows attackers who have already compromised the browser to bypass its security protections and gain higher-level system access. While technical severity is critical, real-world exploitation probability is minimal (0.1%), with no confirmed active attacks to date; however, this warrants prompt patching for organizations where macOS users access sensitive business functions through Chrome.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Race conditions occur when multiple concurrent requests exploit the brief time gap between checking a condition and acting upon it (TOCTOU - Time of Check, Time of Use).
Related Vulnerabilities in Google Chrome Prior to 151.0.7922.72 Security Flaws
View all 80Same weakness CWE-362 – Race Condition
View allSame technique Information Disclosure
View allVendor StatusVendor
SUSE
Severity: Critical| Product | Status |
|---|---|
| SUSE Package Hub 15 SP7 | Fixed |
| openSUSE Leap 16.0 | Fixed |
| SUSE Package Hub 15 SP7 | Affected |
Exploit-DB